3 ms·

Just delete your LinkedIn. I did. It's great. People just email me now and email is way better in almost all ways. I can filter it more easily, I can forward it

Just delete your LinkedIn. I did. It's great. People just email me now and email is way better in almost all ways. I can filter it more easily, I can forward it more easily, the spam filter catches clueless recruiters. Everything is literally better with no drawbacks at all. Also, after being exposed to the OSINT community via the Arms Control community, I learned how crazy dangerous it is to have your whole organization on there. If I ever have a company with employees I'm going to make it part of the employment agreement (and a fireable offense) to add the position to LinkedIn. It's a complete gold mine for competitors and social engineers. People can put "Long Term Data Science Contract" if they really want to, but ideally I'd be able to convince them to just delete it or, at the very least, ramp up the security settings after deleting fake connections. It's definitely useful, but mostly for other people.

ryandrake 8y ago
Can you point out any specific “dangers” of employees having LinkedIn accounts? How much $$ over market value would you offer to compensate an employee for not using it?
- guitarbill 8y ago
  Someone scraped LinkedIn to find ICE employees [0]. It's common to look at job openings to figure out what a company might be working on next, conversely you can sometimes draw conclusions on how those skunkwork programs are going by seeing if key people still work for the company (if they're highly specialised). [0] https://motherboard.vice.com/en_us/article/435myg/programmer-used-linkedin-to-find-ice-employees-database https://motherboard.vice.com/en_us/article/435myg/programmer...
  - ryandrake 8y ago
    These seem like pretty lightweight dangers. So your competitor can get a list of your employees. Who cares? You can go there and get a list of people working for my employer if you want. These also seem like concerns for the employer, not the employee. What danger would motivate an employee to delete their account?
    - emodendroket 8y ago
      I guess in the worst case someone could find out you're associated with an unpopular or controversial organization. I think the paranoia about someone finding your org chart is pretty extreme but I've worked at a place where they were like that.
    - CynicalDio 8y ago
      The only real danger I could think of is if you have a database administrator working for you and it says as much on LinkedIn, you could then check that DB admins qualifications that they have also provided on LinkedIn and determine the specific tech stack that your company is using. Example: John Smith is an expert in Oracle 11, John works at your company, for an attacker, they would then focus on potentially exploiting that system version.
- 3pt14159 8y ago
  Hey sorry for the delay. So I had the pleasure of watching a non-evil social engineer at work once. He thought about humans like I think about networks. He treated LinkedIn like a network map. He treated secretaries like firewalls. He started with the coop students. He'd pretend to be from the university the coop student went to. Of course the call gets forwarded. Of course he does a full interview with the coop student and learns their tech stack. Coop student doesn't know better so questions like: "We're trying to make sure we train our students with the technology that is actually used in the field. Are they giving you guys Macs or PCs? PCs, eh? Windows or Linux? Great. Oh, one last thing, Dell is sponsoring a new building; any chance you guys are on Dell? Oh, Lenovo; ok. No problem. Can you transfer me to your boss [the head of IT] I have some questions for him." Bossman, who they know isn't within earshot of the coop because they asked the student if they had enough space from their boss before the interview, picks up the phone. "Hi Mr. Bossman I'm Steve, your new Lenovo rep, calling about some great new gear we have that we think you guys might really enjoy. Studies are showing that high density pixel laptops are better for worker productivity, but before we do a full pitch to Frank [the decision maker at the company, which we learned from LinkedIn / interviewing the coop] we'd like to make sure it is what you guys in IT would really want. Can we send a couple over for free and get your comments about what you think?" Bam. Root of the head of IT. Because you control the actual laptop you throw in a GSM card and not even network monitoring would set off alarm bells. Took one phone call that wouldn't have been possible without LinkedIn.

ryandrake 8y ago

Can you point out any specific “dangers” of employees having LinkedIn accounts? How much $$ over market value would you offer to compensate an employee for not using it?

guitarbill 8y ago
Someone scraped LinkedIn to find ICE employees [0]. It's common to look at job openings to figure out what a company might be working on next, conversely you can sometimes draw conclusions on how those skunkwork programs are going by seeing if key people still work for the company (if they're highly specialised). [0] https://motherboard.vice.com/en_us/article/435myg/programmer-used-linkedin-to-find-ice-employees-database https://motherboard.vice.com/en_us/article/435myg/programmer...
- ryandrake 8y ago
  These seem like pretty lightweight dangers. So your competitor can get a list of your employees. Who cares? You can go there and get a list of people working for my employer if you want. These also seem like concerns for the employer, not the employee. What danger would motivate an employee to delete their account?
  - emodendroket 8y ago
    I guess in the worst case someone could find out you're associated with an unpopular or controversial organization. I think the paranoia about someone finding your org chart is pretty extreme but I've worked at a place where they were like that.
  - CynicalDio 8y ago
    The only real danger I could think of is if you have a database administrator working for you and it says as much on LinkedIn, you could then check that DB admins qualifications that they have also provided on LinkedIn and determine the specific tech stack that your company is using. Example: John Smith is an expert in Oracle 11, John works at your company, for an attacker, they would then focus on potentially exploiting that system version.
3pt14159 8y ago
Hey sorry for the delay. So I had the pleasure of watching a non-evil social engineer at work once. He thought about humans like I think about networks. He treated LinkedIn like a network map. He treated secretaries like firewalls. He started with the coop students. He'd pretend to be from the university the coop student went to. Of course the call gets forwarded. Of course he does a full interview with the coop student and learns their tech stack. Coop student doesn't know better so questions like: "We're trying to make sure we train our students with the technology that is actually used in the field. Are they giving you guys Macs or PCs? PCs, eh? Windows or Linux? Great. Oh, one last thing, Dell is sponsoring a new building; any chance you guys are on Dell? Oh, Lenovo; ok. No problem. Can you transfer me to your boss [the head of IT] I have some questions for him." Bossman, who they know isn't within earshot of the coop because they asked the student if they had enough space from their boss before the interview, picks up the phone. "Hi Mr. Bossman I'm Steve, your new Lenovo rep, calling about some great new gear we have that we think you guys might really enjoy. Studies are showing that high density pixel laptops are better for worker productivity, but before we do a full pitch to Frank [the decision maker at the company, which we learned from LinkedIn / interviewing the coop] we'd like to make sure it is what you guys in IT would really want. Can we send a couple over for free and get your comments about what you think?" Bam. Root of the head of IT. Because you control the actual laptop you throw in a GSM card and not even network monitoring would set off alarm bells. Took one phone call that wouldn't have been possible without LinkedIn.